SANS ISC: What crime is this?

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Thanks to Bob, Nathanial, Greg for the help and expert analysis. We received an email similar to this:

= = =

Hi there lovely,I was searching the net few days ago and 
saw your profile. I decided to email you cause I found you 
attractive. I might come down to your city infew weeks. 
Let me know if we can meet each other in person.I am 
attractive girl. I am sure you won't regret it. Reply to 
my personal email at ***.

= = =

It was clearly spam, but what is the crime? So a couple of us responded back via throwaway accounts. We each received emails with pictures of a pretty girl with text similar to this:

= = =

Hello my lonely boy,I am so happy to see that you have 
decided to reply. I don't want to live in Russia because 
I have not any chances here. My best friend last year met 
the man from the USA when she worked there for three months, 
too. She had two jobs. From morning till 4 pm she worked in 
amusement park and after it she worked as a waitress in some 
bar till midnight. I will leave Russia in two weeks or so 
(I can't tell you everything exactly right now) and I would 
like to be sure that I have the man who waits for me there. 
I will work all day and I want to find a man to spend all 
free time together to get to know each other better. If you 
have any interest to meet me I will be more than happy to 
meet you too. Please send picture of you too!!! Now I write 
you from my personal mailbox(***), please write me back here 
and here only. I will be checking it often. 

Kiss you your Elena, (this is my name)

= = =

The scam: get lonely gullible men to wire money so that beautiful Russian women can fly here to work hard by day and date them by night. And of course the money disappears and no girl. It might not hurt to update your awareness programs, or add this to your next awareness email blast. Other links the research team found include:

http://home.wi.rr.com/saruman/articles/articles_fromrussia.html
http://www.stopscammers.com/letter(s)_from1126_to_report1.asp
http://www.womenrussia.com/blocklist.htm

Perhaps the funniest thing, the pictures of the "pretty girl" apparently are Canadian, not Russian, but who can know. Thanks to everyone and we consider the case closed.

Stephen Northcutt - President
The SANS Technology Institute